deps: V8: cherry-pick 821fb3883a8e

Original commit message:

    [serializer] avoid deferring objects with embedder fields

    JS objects with embedder fields cannot be deferred because the
    serialize/deserialize callbacks need the back reference immediately
    to identify the object.

    Refs: nodejs/node-v8#175
    Bug: v8:11146
    Change-Id: I4292f2ab0041f7b0779620437ed26905c194cd9b
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531195
    Reviewed-by: Jakob Gruber <jgruber@chromium.org>
    Commit-Queue: Joyee Cheung <joyee@igalia.com>
    Cr-Commit-Position: refs/heads/master@{#71134}

Refs: v8/v8@821fb38

PR-URL: #35700
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Joyee Cheung <joyeec9h3@gmail.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>

common.gypi

@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.9',
+    'v8_embedder_string': '-node.10',
 
     ##### V8 defaults for Node.js #####
 

deps/v8/src/snapshot/serializer-deserializer.cc

@@ -30,13 +30,18 @@ void SerializerDeserializer::Iterate(Isolate* isolate, RootVisitor* visitor) {
 }
 
 bool SerializerDeserializer::CanBeDeferred(HeapObject o) {
-  // Maps cannot be deferred as objects are expected to have a valid map
-  // immediately. Internalized strings cannot be deferred as they might be
+  // 1. Maps cannot be deferred as objects are expected to have a valid map
+  // immediately.
+  // 2. Internalized strings cannot be deferred as they might be
   // converted to thin strings during post processing, at which point forward
   // references to the now-thin string will already have been written.
+  // 3. JS objects with embedder fields cannot be deferred because the
+  // serialize/deserialize callbacks need the back reference immediately to
+  // identify the object.
   // TODO(leszeks): Could we defer string serialization if forward references
   // were resolved after object post processing?
-  return !o.IsMap() && !o.IsInternalizedString();
+  return !o.IsMap() && !o.IsInternalizedString() &&
+         !(o.IsJSObject() && JSObject::cast(o).GetEmbedderFieldCount() > 0);
 }
 
 void SerializerDeserializer::RestoreExternalReferenceRedirector(